API

Currently the Huntress - Connectwise integration places the approval and resolution in the discussion and internal tabs. That should ideally placed in the resolution tab or give the admin the opportunity to select which tab they would like the API connection to place information.

The API returned Unicode characters, causing incorrect data display for the client. We suggest decoding the data before returning it.

Can the following fields be added to the API: ep.first_field_id: account_unresponsive_threshold ep.first_field_id: organization_unresponsive_threshold

We are working with Rewst for process automation. It'd be great to be able to uninstall agents via API, create/delete users, isolate machines, etc..

We would like to access Potentially Unsecured Credentials through the API. We already use scripts to trigger automation around the signals, however, we must export the list of manually each run. Please make /v1/signals a thing!

Hi Team, I wanted to bring up the possibility of a SIEM API to help us pull usage data for customer account billing. Our MSP partners are fully migrating their EDR, MDR, Security Training, and SIEM stack to the Huntress ecosystem. We currently have three integrations in place for retrieving usage data for EDR, MDR, and SAT. Since SIEM is a newer addition, I wanted to check if an API for this might already exist or if one is planned. Thank you!

We use a custom browser plugin to pop alert banners when things need attention in Huntress. This works really well for all team members when it comes to incidents but when it comes to escalations there doesn't seem to be any way to review/check for these under the API.

I'd like to query Huntress via the API for information regarding any combination of file hashes, names, commands for Autoruns, Binaries, Collected Files, and Monitored Files. This can further Huntress's utility in threat hunting via an analyst or via automation.

I would like this API to allow me to pull external recon into something like Hudu so that I can create alerting.

It's nice that the API has the ability to send the report location URL via the API, but what is the possibility of actually getting the report details like # of computers/servers, changes analyzed, autoruns reviewed, persistence breakdown, # of canaries deployed, incident summary & log for each report back in json?